775578748333_FEDEX.vbs
| Full Report | Management Report | IOC Report | Engine | Info | Verdict | Score | Reports |
|---|---|---|---|---|---|---|---|
|
System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
|
100/100
|
||||
 |
|
5/43
|
| IP | Country | Detection |
|---|---|---|
| 199.195.253.181 | United States |  |
| 52.68.15.223 | United States |  |
| Name | IP | Detection |
|---|---|---|
| rnnfibi.hopto.org | 199.195.253.181 | |
| www.wizumiya.co.jp | 52.68.15.223 | |
| Name | Detection |
|---|---|
| rnnfibi.hopto.org | |
| https://www.wizumiya.co.jp/html/user_data/original/images/Ev | |
| http://pesterbdd.com/images/Pester.pngT | |
| Click to see the 14 hidden entries | |
| https://github.com/Pester/PesterT | |
| https://www.wizumiya.co.jp/u- | |
| http://nuget.org/NuGet.exe | |
| http://pesterbdd.com/images/Pester.png | |
| http://www.apache.org/licenses/LICENSE-2.0.html | |
| https://contoso.com/ | |
| https://nuget.org/nuget.exe | |
| https://contoso.com/License | |
| https://contoso.com/Icon | |
| https://www.wizumiya.co.jp/html/user_data/original/images/Aso-new-WO-S_PAgZvxdaV59.bin | |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | |
| https://www.wizumiya.co.jp/=- | |
| http://www.apache.org/licenses/LICENSE-2.0.htmlT | |
| https://github.com/Pester/Pester | |
| Name | File Type | Hashes | Detection |
|---|---|---|---|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache |
data | # | |
C:\Users\user\AppData\Local\Temp\CSCB8D22C72555343A48341CA7311A8A12.TMP |
MSVC .res | # | |
C:\Users\user\AppData\Local\Temp\CSCF0319BB5C3414E72AB519E7A67BBFBFC.TMP |
MSVC .res | # | |
| Click to see the 30 hidden entries | |||
C:\Users\user\AppData\Local\Temp\Grund.dat |
data | # | |
C:\Users\user\AppData\Local\Temp\RESADA2.tmp |
Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x47e, 9 symbols | # | |
C:\Users\user\AppData\Local\Temp\RESD568.tmp |
Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x482, 9 symbols | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ey3l5zz.5em.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_44sbwrlu.vpn.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ansctxp0.z0a.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5juvrhk.vf2.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdkzcoqz.qqx.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n2mec0pm.ex3.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmioe5ck.e4k.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s0eeuky2.wtr.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbqcuw3q.cze.psm1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yatvffab.mac.ps1 |
very short file (no magic) | # | |
C:\Users\user\AppData\Local\Temp\t20mycit.0.cs |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\t20mycit.cmdline |
UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\t20mycit.out |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.0.cs |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.cmdline |
UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.dll |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\tm43worv.out |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.0.cs |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.cmdline |
UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.dll |
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows | # | |
C:\Users\user\AppData\Local\Temp\yy0zjl34.out |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, CR line terminators | # | |
C:\Users\user\AppData\Roaming\remcos\logs.dat |
data | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.4mIv9YDg.20220121172114.txt |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.D1RoMi0p.20220121172156.txt |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.KCw_zsFX.20220121171948.txt |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.XaMWoUUI.20220121172118.txt |
UTF-8 Unicode (with BOM) text, with CRLF line terminators | # | |
C:\Users\user\Documents\20220121\PowerShell_transcript.936905.p0XZL_7o.20220121172125.txt |
UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators | # | |
